CVE-2026-94171: WordPress CURCY plugin <= 2.2.16 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges to attempt exploitation. The attack vector is network-based and requires user interaction.

Q: What impact could successful exploitation have?

Successful exploitation may affect confidentiality, integrity, and availability at a low level, with scope changed. The supplied severity vector rates the issue 7.1 (High).

Q: Which plugin versions are affected?

CURCY versions 2.2.16 and earlier are identified as affected. The provided data does not identify a fixed version.

Published Sep 30, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in CURCY <= 2.2.16 versions.

Affected Software

1 affected component

WordPress CURCY Plugin<=2.2.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress CURCY – Multi Currency for WooCommerce plugin to a version that resolves this vulnerability.
Fixed in 2.2.17

Event History

Sep 30, 2026

CVE Published

via MITRE·05:38 PM

Data Sourced

via MITRE·05:38 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges to attempt exploitation. The attack vector is network-based and requires user interaction.

What impact could successful exploitation have?

Successful exploitation may affect confidentiality, integrity, and availability at a low level, with scope changed. The supplied severity vector rates the issue 7.1 (High).

Which plugin versions are affected?

CURCY versions 2.2.16 and earlier are identified as affected. The provided data does not identify a fixed version.

CVE-2026-94171: WordPress CURCY plugin <= 2.2.16 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

Which plugin versions are affected?